Privacy notice
for the tuluu.app website and the tuluu app · Last updated: 20 October 2026
This English version is provided for information. The German version prevails.
1. Controller
tuluu GmbH, Haingrabenstr. 28, 60488 Frankfurt am Main, Germany, represented by its Managing Director Helmut Fortunato. Email: support@tuluu.app (subject “Privacy”).
2. At a glance
- The website sets no cookies and uses no tracking. Fonts and images are served from our own server.
- The app uses your data to show toilets nearby, sell ToiletTickets, open doors and provide vouchers.
- The app asks for permission to use your location; you can change this in your device settings at any time.
- We do not sell data. Reports for cities and partners are anonymous and contain no personal data.
3. Website
Hosting and server logs. The website is delivered via Cloudflare, which processes technically necessary data (IP address, date and time, page requested, browser, operating system) to deliver the site securely and fend off attacks. Legal basis: Art. 6(1)(f) GDPR.
Enquiry forms and email. We process the details you send (such as name, organisation, email, phone, message) to answer your enquiry. Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR. A hidden field and a timing check protect the form from spam without collecting additional personal data.
No cookies, no tracking. The website stores nothing on your device and includes no analytics or advertising services.
Links. Links to app stores, social networks and press articles are plain links. Data is only transferred when you click one; the provider's privacy policy then applies.
4. App
Without an account. Searching for toilets works without an account. We process technical data such as IP address, app version and device type and, if you allow it, your location. Legal basis: Art. 6(1)(b) GDPR; access to your device is necessary for the service you request (§ 25(2) no. 2 TDDDG).
User account. ToiletTickets and vouchers require an account. We process your phone number or email address, your name if provided, and a user ID. When you sign in with your phone number we send you a code by SMS. Legal basis: Art. 6(1)(b) GDPR.
Location. With your permission we use your precise location to show nearby toilets and distances and to check that you are near the toilet when buying a ticket. We do not store a movement history. You can withdraw permission in your device settings; you can then search by moving the map.
Map. The map is provided by Google Maps; your IP address, device information and the map area or location are transmitted to Google. Legal basis: Art. 6(1)(b) GDPR, as the map is core to the app.
ToiletTickets and payment. For each purchase we store time, toilet location, partner, price, payment method and ticket status. Payments are processed by payment providers; we only receive a confirmation and billing details, not full card data. The partner sees that a valid ToiletTicket exists, not your account details. Legal basis: Art. 6(1)(b) GDPR; for tax retention Art. 6(1)(c) GDPR.
Vouchers. We store code, value, issuer, validity and redemption. The issuer only receives code, value and time for redemption, not your name. Legal basis: Art. 6(1)(b) GDPR.
Digital door opening. When you open a door via the app we process the lock ID, time and a pseudonymous user ID. The app asks for Bluetooth permission. The log is used for billing, resolving faults and security on site. Legal basis: Art. 6(1)(b) and (f) GDPR.
Suggestions, reports and photos. When you suggest a toilet, add details, report a fault or show a need, we process your input, any attached photo, place and time. Reports are passed to the operator or the responsible city department without your contact details. Please do not photograph people. Legal basis: Art. 6(1)(b) and (f) GDPR.
Anonymous analytics. For cities and partners we analyse usage, peak times, reports and redeemed vouchers per location. These reports contain no personal data.
Support. If you contact us we process your message and contact details to help you, for example with refunds. Legal basis: Art. 6(1)(b) or (f) GDPR.
5. Partners, cities and companies
For contracts with businesses, municipalities and companies we process contact details of contact persons, contract, billing and bank details and tax information. Legal basis: Art. 6(1)(b) and (c) GDPR; for communication with contact persons Art. 6(1)(f) GDPR.
6. Recipients and providers
We use providers that process data on our behalf and under our instructions (Art. 28 GDPR). Some payment providers act as independent controllers.
| Purpose | Recipient | Data |
|---|---|---|
| Website hosting and delivery | Cloudflare, Inc., San Francisco, USA (EU-US Data Privacy Framework, standard contractual clauses) | IP address, technical access data |
| Email delivery of website forms | [provider, recommended: Brevo, Sendinblue SAS, Paris, France] | Form data |
| App backend: account, database, SMS sign-in | [confirm provider, likely Google Firebase, Google Ireland Ltd., Dublin] | Account data, phone number, ticket and voucher data |
| Map display in the app | Google Maps, Google Ireland Ltd., Dublin, Ireland | Location, IP address, device information |
| Payment by PayPal | PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg (independent controller) | Payment data |
| Payment by card, Apple Pay, Google Pay | [payment provider] | Payment data |
| Digital locks (smart lock, gateway) | [provider and server location of the lock cloud] | Lock ID, time of opening, pseudonymous user ID |
| App usage analytics | [if used: tool, e.g. Google Analytics for Firebase; consent required] | Usage events, device ID |
7. Transfers outside the EU
Some providers are based in the USA or access data from there. We only transfer data on the basis of an adequacy decision, such as the EU-US Data Privacy Framework for certified companies, or EU standard contractual clauses.
8. Retention
- Website server logs: only as long as needed for delivery and security; we do not analyse them ourselves.
- Enquiries: until settled; for business relationships according to commercial and tax retention periods.
- User account: until the account is deleted.
- ToiletTickets and payments: statutory retention periods (eight or ten years under German tax and commercial law).
- Lock opening logs: twelve months.
- Reports and photos: until the fault is fixed or the suggestion handled; anonymised afterwards for statistics.
9. Your rights
You have the right of access, rectification, erasure, restriction, data portability (Art. 15–20 GDPR) and to withdraw consent with effect for the future (Art. 7(3) GDPR).
Right to object: where we process data based on legitimate interests (Art. 6(1)(f) GDPR) you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).
You can delete your account and its data in the app or by emailing support@tuluu.app. Billing data we must keep by law is restricted until the end of the retention period. You may lodge a complaint with a supervisory authority, for example the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany.
10. Further information
We do not make automated decisions under Art. 22 GDPR and do not use your data for personalised advertising. Data transfer between app, website and our servers is encrypted. We are currently not required to appoint a data protection officer. We update this notice when our services or the law change.